Take a position either in support of or in opposition of the following statement: “An organization with a solid business plan and risk management plan does not need an information security strategy, as long as it has sufficient information security policies and procedures in place.” Explain your position (for or against) and justify your answer.